We offer the below courses internationally also as
on-site training to law enforcement agencies and corporate
customers on request (in English or German, only for reasonably sized
groups). If you are interested, please contact us by
e-mail and let us know the number of prospective attendees and the
address of your facilities. However, demand is currently very high, and we
may only be able to accommodate the most important requests (i.e. for the
basic 4-day course, for large groups) and in such cases try to provide you with an individual quote.
Thank you very much.

This main training course is focused on the systematic and efficient examination of
computer media using our integrated computer forensics software X-Ways
Forensics. After attending this course, you may start
the X-PERT certification
process (though taking the advanced course as well, see below, is
recommended).

Complete and systematic coverage of most computer forensics features in
WinHex and X-Ways Forensics.
Hands-on exercises, simulating most aspects of the complete computer
forensics process. Attendees are encouraged to immediately try newly
gained insights as provided by the instructor, with sample image files.
Many topics are explained along with their theoretical background (slack
space, partially initialized space, how hash databases are
internally structured, how deleted partitions are found automatically,
with what methods X-Ways Forensics finds deleted files, etc. etc.). Other topics
are forensically sound disk imaging and cloning, data recovery, search
functions, dynamic filtering, report creation, ... You will receive complete
printed training material for later repetition. Prerequisite: basic
knowledge of computer forensics.

The students will learn e.g. how to get the most thorough overview
conceivable of existing and deleted files on computer media, how to scan
for child pornography in the most efficient way, etc. There will be a
practical exam at the end of the course, which you can regard as just
another exercise for yourself or that you can take more seriously and
get scored by the instructor if you like. The exam recapitulates the
most important functions of the software and helps you to gauge your
proficiency. The results will not be recorded by us in any way. Note
that the instructor will present the answers to the test during the
final 20 minutes.

It is the goal to be able to draw sustainable conclusions from the data
and metadata stored on or seemingly deleted from media to answer to
specific problems while documenting the proceedings in a manner
acceptable in court.
Examples:
"What documents were altered on the evening of January 12, 2012?"
"What pictures were hidden with what method, where and by whom?"
"Who viewed which web pages on what day?"
"Which MS Excel documents saved by Alan Smith contain the word
'invoice'?"
"Which USB sticks were attached to the computer at what time?"

X-Ways Forensics II, 2 days

Advanced training course for experienced users and
previous attendees of the main course. Topics may include (not all
guaranteed because of time constraints, instructor availability or for other reasons):

Variable combination of file system courses, with
extensive introduction to file system basics (binary data storage
concepts, data types, date formats) and for example to the file systems FAT12, FAT16, FAT32 (1/2 day), NTFS (1 day), and Ext2/Ext3/Ext4
(1/2 day). See below for file system courses that are available.

By fully
understanding the on-disk structures of the file system, you are able
to recover data manually in many severe data loss scenarios, where automated recovery software fails,
and to verify
the correct function of computer forensics software and to collect meta information beyond what is reported
automatically, which might yield clues for the given case. In general,
this also leads to a better understanding of the data presented by
forensic software, of how computer forensics software works and of its
limitations.

Immediate application of newly gained knowledge by examining data structures on a practical example
with WinHex. These exercises will ensure you will remember what you have learned.
Explanation of the effects of file deletion and potentials for file
recovery. By the
end you will be able to navigate almost intuitively on a hard disk and to identify various
sources of information with relevance to forensics. You will be enabled
to recover data manually in several cases even where automated software
fails and to verify the results computer forensics software reports
automatically. You will receive a complete
documentation of all the filesystems discussed in this course, with all the training material for later repetition. Prerequisite:
general
computer science knowledge recommended (not just computer knowledge).